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Amendments to the Specification 

Replace the paragraph beginning at page 6, line 18 with: 

Computer 100 may also have input devices such as a keyboard, mouse, pen, voice 
input device, touch input device, etc. Output devices such as a display 118 -146, speakers, 
a printer, etc. may also be included. All these devices are well known in the art and need 
not be discussed at length here. 

Replace the paragraph beginning at page 8, line 20 with: 

Referring to FTG.5, another example of a UI may be used in an embodiment of the 
invention is shown. The UI, generally labeled 500, includes a first pull down menu 502 
and a first explanation field 503, a second pull down menu 504 and a second explanation 
field 505, and a text input area 506. The UI 500 further includes an OK button 508, a 
cancel button 510, and a help button 512. The first pull down menu 502 allows the user 
to choose an action to perform, such as shutting down the computer. Other possible 
actions listed in the pull down menu 502 include logging off a network, or restarting the 
computer. The first explanation field 503 gives the user a textual explanation of the menu 
item. The second pull down menu 504 allows the user choose a reason for performing the 
action chosen in the first pull down menu 502. For example, if the action chosen in the 
first pull down menu 502 is "shut down," then the choice given to the user in the second 
pull down menu 504 may include, for example, hardware maintenance, operating system 
configuration, software installation system failure, power failure and system hung. The 
second explanation field 505 gives the user a textual explanation of the chosen menu 
item. The text input area 506 5G4 allows the user to enter additional comments such as 
"power failure was building-wide." 

Replace the paragraph beginning at page 10, line 1 with: 
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There are a variety of way$ in which a user-mode snapshot may be implemented. 
Referring to FIG. 1 3, one example of a user-mode snapshot will now be illustrated and 
described. Tn this example, a computer 1 300 has just experienced an unexpected 
shutdown, as indicated by the shutdown reason entered by a user 1 302. Prior to shutting 
down, the computer 1300 takes a snapshot 1304 of its user-mode processes and stores it 
on its internal hard disk 1306. The snapshot 1304 4308 is an extensible mark-up 
language (XML) file that includes per process parameters 1310 for each user-mode 
process, pagefile parameters 1312, and system parameters 1314. The per process 
parameters 1310 describe those conditions that are relevant to a single process, and may 
include one or more of the following pieces of information: 

• User time: The amount of time in seconds that the process kept the processor in 
user mode. 

• Kernel time: The amount of time in seconds that the process kept the processor in 
kernel mode. 

• Working set: The amount of memory the process was using at the time the 
snapshot was taken. 

• Total page faults: The number of times the processor was forced to go to virtual 
memory on the computer's hard drive. 

• Bytes committed: The number of bytes of memory the process had reserved at the 
time of the snapshot, regardless of whether all of it was actually used, 

• Process priority: The priority of the process vis-i-vis the rest of the processes. 

• Number of handles: The number of handles, or pointers to blocks of memory 
being used by the process. 

• Number of threads: The number of threads that were defined within the process at 
the time the snapshot was taken. 

Replace the paragraph beginning at page 15, line 14 with: 

Referring to FIGS. 9 and 10, another example of steps that may be taken to collect 
shutdown information for a computer running the WINDOWS XP brand operating 
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system will now be described. It is assumed that this procedure occurs during a reboot 
operation following an unexpected shutdown of the operating system. It is understood 
that these steps are applicable to non-WINDOWS XP implementations as well, even 
though described in the context of WINDOWS XP. At step 901 (FIG. 9), the user logs in. 
At step 902, the collector module 610 (FIG. 6) checks the system database 640 to 
determine whether shutdown reason collection has been enabled. If it has not been 
enabled, then the flow proceeds to step 91 1, at which a conventional reboot ensues. If 
shutdown reason collection has been enabled, then the collector module 610 retrieves the 
list 612 of shutdown reasons, and retrieves any custom-defined shutdown reasons from 
the system database 640, and displays the reasons on a U1 1 000 (FIG. 1 0) at step 903. At 
steps 904. 906 and 907 90S — 907, the system manager module 6 1 0 waits for the user to 
either select a predefined shutdown reason from the pull-down menu, or enter his own 
reason in the comments box. Optionally, the user may be sent back to step 901 after a 
two minute time-out. After the user selects or enters a reason, the collector module 610 
enables the OK button (step 908). After the user clicks OK (step 909), then the collector 
module 610 calls the log file helper function directly and stores the entered reason in the 
repository 620 (step 910). At step 91 1, the WINDOWS XP operating system resumes its 
normal booting operation. 

Replace the paragraph beginning at page 16, line 1 1 with: 

Referring to FIG. 1 1 , yet another example of an architecture that may be used in 
an embodiment of the invention is shown. The architecture comprises a first computer 
system 1 100 that includes a shutdown reason collector module 11) 0 having a list 1 1 12 of 
predefined shutdown reasons, a user interface 1 1 30, o snapshot module 1172, and an 
optional system database 1 140. The architecture farther comprises a computer network 
1 150, and a second computer system 1 160 having a memory 1 162 . and a snapshot module 
1172. The memory 1 1 62 further includes a shutdown reason repository 1 170, which may 
be a log file. The first and second computer systems may communicate with one another 
over the network 1 150. The system database 1 140 may include predefined shutdown 
reasons in addition to those in the list 1 1 12 of the collector module. A user at the first 
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computer system 1 100 may remotely shut down a program on the second computer 
system 1 1 60 via the user interface 1 1 30. The user interface 1130 also gives the user an 
opportunity to enter a reason for the shutdown. The collector module 1110 checks the list 
1 1 12, as well as the system database 1 140 to ensure that the entered reason is 
recognizable. If, based on the entered reason, the collector module 1 1 10 determines the 
shutdown to be unplanned, then the collector module 1110 invokes the snapshot module 
1 1 72, which takes a snapshot of the state of the user-mode processes and saves the 
snapshot on the non-volatile memory of the computer system 1 1 60. The collector module 
1110 then stores the shutdown reason remotely in the log file 1112. Storing the shutdown 
reason on the second computer system 1 160 is advantageous, since it is a program on the 
second computer system that is being shutdown, even though the action was initiated 
from the first computer system. 
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